At the time, Nansen's Alex Svanevik said, "It's unclear exactly who's making the transactions, but you wouldn't expect to see these on-chain trades at this time.
He said FTX's main wallet was entirely drained of FTT.
Additionally, Reuters reported that SBF had a "backdoor" in FTX's book-keeping system, which allowed him to move customer money around without triggering internal compliance or accounting red flags.
During the week, more details came out that suggested at least some of this outflow was in fact an apparently sanctioned transfer from FTX to Bahamian regulators (https://decrypt.co/115008/ftx-bankruptcy-jurisdiction-fightbahamas-regulator-directed-sbf-asset-move) - who rejected the exchange's US bankruptcy filing and took possession of some of the assets.
"[There is] credible evidence that the Bahamian government is responsible for directing unauthorized access to the Debtors' systems for the purpose of obtaining digital assets of the Debtors—that took place after the commencement of these cases," read the filing, signed by new FTX CEO John Ray, famous for handling the liquidation of Enron.
The company went on to say that its co-founders Sam Bankman-Fried and Gary Wang were recorded saying that Bahamanian regulators instructed the pair to make "certain post-petition transfers" and that such assets were "custodied on FireBlocks under control of [the] Bahamian government."
However, although initial reports suggested that all of the funds in question might be in the custody of securities regulators (https://cointelegraph.com/news/bahamiansecurities-regulator-ordered-the-transfer-of-ftx-s-digitalassets) in the Bahamas, Chainalysis poured cold water on this theory however, stating:
“Reports that the funds stolen from FTX were actually sent to the Securities Commission of The Bahamas are incorrect. Some funds were stolen, and other funds were sent to the regulators.”
And as Bloomberg reported earlier in the week (https://www.bloomberg.com/news/articles/2022-11-16/ftxhacker-emerges-with-a-288-million-stash-of-the-token-ethereth), the hackers who stole the funds have become one of the world's largest holders of the Ether token.
According to security specialists PeckShield, a wallet (https://blockchair.com/ethereum/address/0x59abf3837fa96 2d6853b4cc0a19513aa031fd32b) linked with the exploit swapped about another $49 million of stablecoins - mainly Dai - for Ether on Tuesday. That lifted the attacker’s Ether haul to 228,523 or about $288 million - the 35th largest stash of the coin, according to data (https://etherscan.io/accounts/2) from analytics platform Etherscan.
The hacker reportedly transferred some funds using the crypto exchange operated by Kraken, which said it had been in touch with law enforcement about the matter.
But now, as Coinpedia.org reports (https://coinpedia.org/news/ftx-hacker-finally-startsliquidating-huge-amount-of-ethereum/), the FTX hacker has begun to liquidate those holdings creating significant downward pressure on Ethereum's price.
As PeckShield further detailed earlier today, the FTX hacker is swapping ETH for BTC via renBTC bridge protocol... You can monitor the FTX Hacker's moves here...
Notably, renBTC liquidity is not deep enough for the FTX Hacker to dump all his ETH. If renBTC minting is disabled, the liquidity can’t be refilled, so the hacker may speed up.
Which is perhaps why, as @kamikaz_ETH notes (https://twitter.com/kamikaz_ETH/status/159427666379344 6912?s=20&t=X0NVlmkRN6hTuRPKeUb5Bw), the FTX Hacker is now steadily dumping ETH on-chain - which is why we are seeing the sudden purges in Ethereum's price.
This could be a problem for ETH as if 50k ETH drove the drop from $1220 to $1160, the remaining 200k ETH could do some more serious damage to price.
FTX itself has tweeted to urge exchanges to block these transfers from the FTX Hacker...
Finally, one source suggested that perhaps the FTX Hacker realized that The Office of Foreign Assets Control (OFAC) can sanction the address where they are holding the hacked ETH and thereby make the ETH worthless...
As 76% of validators (and rising) enforce OFAC sanctions - accordingly they wouldn't include ETH transactions from sanctioned addresses..
Hence the sudden urgency to discard the ETH for bitcoin via RenBTC bridge ...
Probably they had a tip off that OFAC is planning to do this tomorrow...
Now who would have the political connections with the administration to know that info in advance?
